feat: update controls in the admin, release token scope, build info in CI images [CI]

The versions page shows each node's update state with update buttons, API
tokens get a release scope that can only register releases (used by CI), and
the CI image and release builds now pass the tag, commit and build time.

backend/src/Monitor.Backend.Api/Admin/BuildEndpoints.cs

@@ -19,13 +19,18 @@ public static class BuildEndpoints
             .Returns<BuildInfoDto>().ProducesProblems(401, 403);
         group.MapGet("/releases", ListReleasesAsync)
             .Api("releases_list", "The latest signed release manifest of each component", Tag).Returns<PageDto<ReleaseDto>>().ProducesProblems(401, 403);
-        group.MapPost("/releases", PublishReleaseAsync)
-            .Api("releases_publish", "Register a CI-signed release manifest; online nodes get it right away (their updaters verify the signature)", Tag)
-            .Returns<ReleaseDto>(StatusCodes.Status201Created).ProducesProblems(400, 401, 403, 409);
         group.MapPost("/nodes/{id}/update", RequestUpdateAsync)
             .Api("nodes_update", "Ask an online agent or probe to install the release it has been offered", Tag).Returns<object>(StatusCodes.Status204NoContent).ProducesProblems(401, 403, 409);
     }
 
+    /// <summary>登记发布清单：挂在 <see cref="ReleaseGuard"/> 下，除了管理员，CI 用的 <c>release</c> 令牌也能调用（它只能做这一件事）。</summary>
+    public static void MapPublish(RouteGroupBuilder group)
+    {
+        group.MapPost("/releases", PublishReleaseAsync)
+            .Api("releases_publish", "Register a CI-signed release manifest; online nodes get it right away (their updaters verify the signature). Admin or release tokens", Tag)
+            .Returns<ReleaseDto>(StatusCodes.Status201Created).ProducesProblems(400, 401, 403, 409);
+    }
+
     private static async Task<IResult> GetAsync(HttpContext http, NodeInfoService nodes, ReleaseService releases, CancellationToken ct)
     {
         var items = (await nodes.ListAsync(ct))

backend/src/Monitor.Backend.Api/ApiModule.cs

@@ -103,6 +103,8 @@ public static class ApiModule
         RouteGroupBuilder admin = app.MapGroup("/api/admin");
         AuthEndpoints.MapLogin(admin);
 
+        BuildEndpoints.MapPublish(admin.MapGroup(string.Empty).AddEndpointFilter(ReleaseGuard.InvokeAsync));
+
         RouteGroupBuilder guarded = admin.MapGroup(string.Empty).AddEndpointFilter(AdminGuard.InvokeAsync);
         AuthEndpoints.MapSession(guarded);
         AgentEndpoints.Map(guarded);

backend/src/Monitor.Backend.Api/Common/Guards.cs

@@ -62,7 +62,7 @@ public static class AdminGuard
         Principal principal = http.GetPrincipal();
         if (!principal.IsAdmin)
         {
-            return principal.CanRead
+            return principal.Scope != ApiScope.None
                 ? Problems.Create(http, MonitorErrors.Forbidden, "the token scope does not allow this operation")
                 : Problems.Create(http, MonitorErrors.Unauthorized, "authentication is required");
         }
@@ -80,6 +80,13 @@ public static class AdminGuard
     }
 }
 
+/// <summary>登记发布清单的守卫：管理员（会话要带 CSRF）或 release 令牌；release 令牌只能做这一件事。</summary>
+public static class ReleaseGuard
+{
+    public static async ValueTask<object?> InvokeAsync(EndpointFilterInvocationContext context, EndpointFilterDelegate next) =>
+        context.HttpContext.GetPrincipal().Scope == ApiScope.Release ? await next(context) : await AdminGuard.InvokeAsync(context, next);
+}
+
 /// <summary>展示层守卫：站点公开时匿名可读；私有时需要登录或只读令牌。</summary>
 public static class PublicGuard
 {

backend/src/Monitor.Backend.Application/Auth/AuthModels.cs

@@ -7,12 +7,13 @@ public enum PrincipalKind
     Token,
 }
 
-/// <summary>访问级别：作用域为 read 的令牌只读，admin 可以管理。</summary>
+/// <summary>访问级别：作用域为 read 的令牌只读，admin 可以管理，release 只能登记发布清单（给 CI 用，什么都读不了）。</summary>
 public enum ApiScope
 {
     None = 0,
-    Read = 1,
-    Admin = 2,
+    Release = 1,
+    Read = 2,
+    Admin = 3,
 }
 
 public sealed record Principal(PrincipalKind Kind, ApiScope Scope, string? UserId, string? Username, string? CsrfToken, string? TokenId)
@@ -22,6 +23,8 @@ public sealed record Principal(PrincipalKind Kind, ApiScope Scope, string? UserI
     public bool CanRead => Scope >= ApiScope.Read;
 
     public bool IsAdmin => Scope >= ApiScope.Admin;
+
+    public bool CanPublishRelease => Scope is ApiScope.Release or ApiScope.Admin;
 }
 
 public sealed record LoginResult(string SessionToken, string CsrfToken, long ExpiresAtMs, string UserId, string Username);

backend/src/Monitor.Backend.Application/Auth/AuthService.cs

@@ -77,7 +77,7 @@ public sealed partial class AuthService
             await _store.TouchApiTokenAsync(token.Id, now, ct);
         }
 
-        ApiScope scope = token.Scope == "admin" ? ApiScope.Admin : ApiScope.Read;
+        ApiScope scope = token.Scope switch { "admin" => ApiScope.Admin, "release" => ApiScope.Release, _ => ApiScope.Read };
         return new Principal(PrincipalKind.Token, scope, null, token.Name, null, token.Id);
     }
 
@@ -135,9 +135,9 @@ public sealed partial class AuthService
             return ValidationError.Fail<CreatedApiToken>("name", "must be 1-64 characters");
         }
 
-        if (scope is not ("read" or "admin"))
+        if (scope is not ("read" or "admin" or "release"))
         {
-            return ValidationError.Fail<CreatedApiToken>("scope", "must be read or admin");
+            return ValidationError.Fail<CreatedApiToken>("scope", "must be read, admin or release");
         }
 
         string plaintext = TokenHash.NewToken("mon");